ldapi

LDAP injection — auth bypass via filter manipulation, blind data extraction, search filter abuse, DN injection.

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/ldapi/SKILL.md

Quality

Content

66%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and highly actionable with concrete payloads and a defender section, but it presents techniques as a catalog rather than a sequenced workflow and lacks validation checkpoints for the batch blind-extraction operation. Progressive disclosure and structure are solid for a short single-purpose skill.

Suggestions

Add a short end-to-end workflow (recon → confirm injection with the wildcard PoC → blind extraction → verify extracted data) with an explicit 'verify the payload worked' checkpoint.

Turn the blind-extraction snippet into a complete runnable loop with a concrete success-condition check on the response.

Add one line on response interpretation (what 'found' looks like) so the examples are copy-paste runnable.

Dimension	Reasoning	Score
Conciseness	Lean throughout: minimal one-line syntax intro plus tight code blocks per technique with almost no padding; only a few labels could be trimmed, keeping it well above the midpoint.	4 / 5
Actionability	Concrete executable Python and curl examples for each technique (auth bypass, blind extraction, DN injection, PoC, defender fix) with real payload strings; minor gaps such as the blind-extraction loop being schematic rather than a complete runnable script.	4 / 5
Workflow Clarity	Techniques are grouped and labeled but there is no end-to-end attack workflow or validation checkpoint (e.g. verify a payload worked before iterating); the blind-extraction loop is a batch operation without a verify/confirm step, which caps this at 3.	3 / 5
Progressive Disclosure	Well-organized numbered sections serve as a clear overview, and the one external reference (the upstream _corpus payload directory) is a single-level, clearly signaled pointer; no bundle files exist to verify, but structure is appropriate for this short skill.	4 / 5
	Total	15 / 20 Passed

Description

51%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-targeted to LDAP injection with strong trigger terms, but it lacks an explicit 'Use when...' clause that tells Claude when to invoke it, which caps completeness. Third-person voice is maintained and conflict risk is low.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing LDAP authentication, querying Active Directory, or when user input is concatenated into LDAP search filters.'

Consider including a synonym or file/protocol signal (e.g. 'LDAP, Active Directory, RFC 4515 filters') to broaden natural-term coverage.

Tighten the em-dash list into a single concise sentence plus a 'Use when' sentence to match the good-overall examples.

Dimension	Reasoning	Score
Specificity	Lists several concrete attack techniques ('auth bypass via filter manipulation', 'blind data extraction', 'search filter abuse', 'DN injection'), giving good coverage of the domain with only minor gaps in mechanism detail.	4 / 5
Completeness	The 'what' is clear (LDAP injection attacks) but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description, so per the rubric completeness is capped low; only a weak 'when' is implied via metadata keywords.	2 / 5
Trigger Term Quality	Includes natural keywords a user would say ('ldap injection', 'auth bypass', 'active directory', 'filter', 'dn', 'search'); a few common synonyms or phrasings are missing but coverage is strong.	4 / 5
Distinctiveness Conflict Risk	Niche is well-scoped to LDAP injection specifically and is unlikely to conflict with the general AD skill; minor overlap risk exists with broader injection or active-directory skills.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/ldapi/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.